Harden workflows

per https://app.stepsecurity.io Signed-off-by: Dave Thaler <[email protected]>
l3af-project · Jun 9, 2022 · 787a37c · 787a37c
1 parent 111f889
commit 787a37c
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 4 deletions.
diff --git a/.github/workflows/ci-build-windows.yaml b/.github/workflows/ci-build-windows.yaml
@@ -13,19 +13,27 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: windows-latest
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813
+        with:
+          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
       - name: Set up git env
         run: |
           git config --global core.autocrlf false
           $gopath = (go env GOPATH)
           echo "GOPATH=$gopath" >> $env:GITHUB_ENV
 
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@d0651293c4a5a52e711f25b41b05b2212f385d28
 
       - name: Format
         run: |
@@ -46,7 +54,7 @@ jobs:
         run: |
           go test -tags WINDOWS ./...
 
-      - uses: dominikh/staticcheck-action@v1.1.0
+      - uses: dominikh/staticcheck-action@4ec9a0dff54be2642bc76581598ba433fd8d4967
         with:
           version: "2021.1.2"
           install-go: false

diff --git a/.github/workflows/ci-build.yaml b/.github/workflows/ci-build.yaml
@@ -5,20 +5,28 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     container:
       image: golang:1.16.10-alpine3.14
 
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@248ae51c2e8cc9622ecf50685c8bf7150c6e8813
+        with:
+          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
       - name: Set up environment
         run : |
           apk update
           apk add gcc libc-dev bash perl curl make
           
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@d0651293c4a5a52e711f25b41b05b2212f385d28
 
       - name: Format
         run: |
@@ -38,7 +46,7 @@ jobs:
         run: |
           go test ./...
 
-      - uses: dominikh/staticcheck-action@v1.1.0
+      - uses: dominikh/staticcheck-action@4ec9a0dff54be2642bc76581598ba433fd8d4967
         with:
           version: "2021.1.2"
           install-go: false